Which outcome involves identifying and prioritizing stakeholder assets?

• A. The types of information processed, stored, and transmitted by the system are identified.
• B. The authorization boundary is determined.
• C. Mission/business processes identified.
• D. Stakeholder assets are identified and prioritized.

Answer: (D)

Identifying and prioritizing stakeholder assets focuses the risk effort on what matters most to the organization and its stakeholders. It involves listing valuable items—data, systems, facilities, people, processes, and even reputation—and then ranking them by importance or criticality. This ensures that protective measures and resources are concentrated where they will have the greatest impact on mission success and risk reduction. By knowing which assets are most valuable, you can tailor controls and response plans to protect those assets effectively and allocate attention where it yields the biggest payoff.

The other options cover related but different activities. Identifying the types of information processed, stored, and transmitted is about data classification, not prioritizing assets. Determining the authorization boundary defines the system’s scope and perimeter, not which assets matter most. Identifying mission or business processes maps the organizational context, which is important but doesn’t directly establish asset prioritization.